{"action":"Upgrade @ckeditor/ckeditor5-list to 27.0.0 or later.","affected":[{"fixed":"27.0.0","introduced":"0"}],"component":"@ckeditor/ckeditor5-list","cve_ids":["CVE-2021-21391"],"ecosystem":"npm","epss":0.01667,"exploited":false,"fixed_versions":["27.0.0"],"ghsa_id":"GHSA-3rh3-wfr4-76mj","id":"tcs_01M5KEY6R7Z0Y3X4RAZWEJ1592","modified_at":"2026-07-08T06:27:26.938294321Z","published_at":"2021-04-06T17:28:41Z","references":["https://osv.dev/vulnerability/GHSA-3rh3-wfr4-76mj","https://github.com/ckeditor/ckeditor5/security/advisories/GHSA-3rh3-wfr4-76mj","https://nvd.nist.gov/vuln/detail/CVE-2021-21391","https://github.com/ckeditor/ckeditor5/releases/tag/v27.0.0","https://www.npmjs.com/package/@ckeditor/ckeditor5-engine","https://www.npmjs.com/package/@ckeditor/ckeditor5-font","https://www.npmjs.com/package/@ckeditor/ckeditor5-image","https://www.npmjs.com/package/@ckeditor/ckeditor5-list","https://www.npmjs.com/package/@ckeditor/ckeditor5-markdown-gfm","https://www.npmjs.com/package/@ckeditor/ckeditor5-media-embed","https://www.npmjs.com/package/@ckeditor/ckeditor5-paste-from-office","https://www.npmjs.com/package/@ckeditor/ckeditor5-widget"],"severity":{"label":"medium","score":6.5},"sources":[{"source":"osv","source_id":"GHSA-3rh3-wfr4-76mj#npm/@ckeditor/ckeditor5-list","url":"https://osv.dev/vulnerability/GHSA-3rh3-wfr4-76mj"}],"summary":"Regular expression Denial of Service in multiple packages"}